Beyond the Battlefield: What Russia–North Korea Information Ties Mean for U.S. Allies
By Shin-ae Lee
Growing Russia–North Korea ties amid the prolonged war in Ukraine have demonstrated how their military cooperation can further both countries’ broader strategic objectives: advancing Russia’s war aims in Ukraine and bolstering North Korea’s regime security. A similar dynamic could emerge in the information domain, where increasingly aligned Russian and North Korean narratives point to a growing strategic convergence. Closer cooperation could expand Moscow and Pyongyang’s hybrid operations toolbox, allowing them to combine cyberattacks with information manipulation in ways that complicate security calculations for the United States and its allies across the Indo-Pacific and Euro-Atlantic.
A Tale of Two Countries
Russia has a sophisticated toolbox that combines malicious cyber and information operations with other instruments as part of its hybrid campaigns. North Korea, for its part, has developed substantial cyber capabilities, with operations spanning espionage, disruptive attacks, and, notably, illicit revenue generation. Both countries are now expanding these activities beyond their traditional target areas.
Russian cyber activity and malign information operations are increasingly documented across the Indo-Pacific, including in South Korea and Japan. Although the scale and methods of Russian messaging vary by country, the overall intent is to discredit alignment with the United States and its allies and influence national foreign-policy choices, challenge political leadership, and erode support for Ukraine. Russian narratives circulate through official Russian channels, state-linked media outlets, and pro-Russian networks such as Pravda, which operates Korean- and Japanese- language websites. These narratives are also disseminated and amplified on social media, as observed in Japan.
North Korea’s malicious cyber activities, meanwhile, encompass cryptocurrency theft to IT-worker schemes in which North Koreans use false identities to secure remote jobs with foreign companies. Illustrating the expansion in scale and reach of these activities, a September 2026 joint advisory issued by authorities in Japan, the United States, Australia, and Germany reported that a North Korean cyber campaign had compromised at least 30,000 devices across more than 100 countries and exfiltrated funds or credentials from over 7,000 cryptocurrency wallets. Kim Jong Un’s recent call to strengthen the Reconnaissance General Bureau (RGB), which oversees much of the country’s cyber operations, may also signal a widening operational focus beyond South Korea, particularly given his recent reference to “potential enemies,” rather than a single “enemy.”
Cyber links between North Korean and Russian actors already predate the recent deepening of bilateral cooperation. North Korean cyber actors have tapped Russian-speaking criminal networks for access, malware, and laundering services, while recent research has also found possible infrastructure overlap between Russia-linked hacking group Gamaredon and North Korea’s Lazarus Group.
Narratives in Alignment
In the information domain, evidence of comparable operational links remains limited. Several developments, however, could lower the barriers to deeper cooperation and expand North Korea’s opportunities to learn from Russian practices. Russian and North Korean narratives are increasingly converging. Their messaging goes beyond shared criticism of the United States, NATO, U.S.–ROK–Japan security cooperation, and Japan’s military buildup. Moscow and Pyongyang increasingly portray each other’s actions as legitimate measures to defend sovereignty and security, while presenting their partnership as a contribution to regional and global peace and a more just multipolar international order. This reciprocal legitimation gives Moscow and Pyongyang a shared narrative for justifying mutual support across more security and geopolitical issues.
Alongside this narrative convergence, more structured information cooperation is also beginning to take shape. The Comprehensive Strategic Partnership Treaty from 2024 calls for expanded media cooperation, dissemination of “objective information” about both countries, and joint responses to “false information and provocative information activities.” Russian state news agency TASS and its North Korean counterpart KCNA have also agreed to jointly counter what they describe as “disinformation,” in the broader context of contemporary information warfare.
The War Factor
The war in Ukraine adds a distinct dimension by exposing North Korea to Russian wartime practices. Pyongyang is already gaining battlefield experience through its involvement in the conflict. The closer cooperation could also offer opportunities to learn from Russia’s broader hybrid approach, such as how Russia combines cyber and information operations with other instruments to manipulate, influence, divide, and coerce Ukraine and other European countries.
The benefits of closer cooperation are not limited to North Korea. Russia could gain an additional partner with growing geopolitical assertiveness and operational reach. More effective propaganda is only part of the long-term risk. Sustained cooperation could make Russian and North Korean activities across the cyber, information, military, and other coercive domains increasingly interconnected and mutually reinforcing.
Bridging the Indo-Pacific and Euro-Atlantic
During the Korean War, the Soviet Union covertly deployed MiG-15 units flown by Soviet pilots, concealing its involvement by using North Korean or Chinese markings. This allowed Moscow to advance its geopolitical objectives in the early Cold War by supporting North Korea while limiting the risk of a wider confrontation with the United States. Russia and North Korea could similarly provide one another with deniable support through cyber and information operations in peacetime, during crises, and in future regional contingencies.
U.S. cyber cooperation with key Indo-Pacific allies has largely focused on established priorities such as critical infrastructure protection and, in the case of North Korea, disruption of illicit revenue generation. These efforts remain essential, but closer Russia–North Korea ties underscore the need to integrate the information dimension more systematically into broader security responses.
Such integration will require deeper threat-information sharing, closer coordination on public attribution, and more timely allied messaging that takes place before misleading or manipulative narratives gain traction.
The EU increasingly regards information manipulation and cyber threats as elements of broader hybrid campaigns that are undermining its security. It’s Hybrid Toolbox provides an overarching framework for coordinated cross-sectoral responses against such campaigns. NATO similarly integrates information threats into its wider Alliance assessment and response framework. These approaches cannot simply be replicated in the Indo-Pacific given variation in domestic institutions and bureaucratic-political cultures. Nonetheless, the frameworks provide practical lessons for strengthening Indo-Pacific responses, particularly in cross-sectoral coordination, information sharing, and early warning, and make the case for closer cooperation with Euro-Atlantic partners.
Shin-Ae Lee, is a 2026 Bertelsmann Foundation Fellow and a Research Fellow at the Sasakawa Peace Foundation